Would appreciate a response from Fortinet regarding the Apache log4 vulnerability if any Fortinet product
is affected.
Any information regarding updated IPS signature for CVE-2021-44228?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
PSIRT advisory on impacted products can be found here:
https://www.fortiguard.com/psirt/FG-IR-21-245
Dr. Carl Windsor Field Chief Technology Officer Fortinet
Do you have a deep-inspection SSL profile on the policy? Generally, if the payload is encrypted (in HTTPS) the packet contents will not be verified with certificate-inspection only
All signatures updated and properly configured, still not getting triggered. I hope FN will look into it. I can trigger other ones, but not the ID51006
Created on 12-13-2021 07:04 AM Edited on 12-13-2021 07:21 AM
ok, saw other question, eventually it worked for something indeed.
PSIRT advisory on impacted products can be found here:
https://www.fortiguard.com/psirt/FG-IR-21-245
Dr. Carl Windsor Field Chief Technology Officer Fortinet
For FortiWEB, there is a new update for the WAF signatures to prevent attackers from performing variant remote code execution in Apache Log4j2 (CVE-2021-44228)
Reference: https://www.fortiguard.com/updates/websecurity?version=0.00306
There is a new update for the WAF signatures to prevent attackers from performing variant remote code execution in Apache Log4j2 (CVE-2021-44228)
Reference: https://www.fortiguard.com/updates/websecurity?version=0.00306
We had a popup today on an end user machine indicated a detection and block for this. I can't find a reason for it, though. It's a workstation without Apache or Log4J installed. Does this plugin identify going to a vulnerable external website? My impression is that it only triggered on a machine if the machine itself was vulnerable.
Problem with this issue, the actual vulnerability can be behind the system being targetted (see the blog here). FortiGate has no way of knowing if the server is vulnerable or of there is log4j somewhere in the path, just that the payload has been sent e.g. in a HTTP header. This is the block you are seeing.
To know if you are potentially vulnerable, block outbound LDAP and look for triggers to the FW rule.
Dr. Carl Windsor Field Chief Technology Officer Fortinet
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.